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Unconditional security proofs of various quantum key distribution (QKD) protocols are built 
cn , on idealized assumptions. One key assumption is: the sender (Alice) can prepare the required 

quantum states without errors. However, such an assumption may be violated in a practical QKD 
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rj , attack that exploits such a security loophole in a commercial "plug & play" QKD system. The 
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I. INTRODUCTION 

Quantum key distribution (QKD) pj-yf enables an ultimately secure means of distributing 
secret keys between two parties, the sender (Alice) and the receiver (Bob). In principle, any 
eavesdropping attempt by a third party (Eve) will unavoidably introduce disturbance and 
be detected. The unconditional security of the BB84 QKD protocol has been rigorously 
proved based on the laws of quantum mechanics [4] , even when implemented on imperfect 
practical setups |5J. 

Unfortunately, a practical QKD system has imperfections. Eve may try to exploit these 
imperfections and launch specific attacks not covered by the original security proofs. Is it 
possible that a small unnoticed imperfection spoils the security of the otherwise carefully 
designed QKD system? This question has drawn a lot of attention. Gisin et al. studied 
a Trojan-horse attack employing the unwanted internal reflection from a phase modulator 
6|. Makarov et al. proposed a faked state attack, which exploits the efficiency mismatch of 
two detectors in a practical QKD system [TJ. Our group has proposed 8[ a simple attack — 
time-shift attack — that exploits the same imperfection. Moreover, we have experimentally 
demonstrated [9|] our attack against a commercial QKD system. This was the first time that 
a commercial QKD system had been successfully hacked, thus highlighting the vulnerability 
of even well-designed commercial QKD systems. Lamas-Linares et al. demonstrated that 
the information leakage due to public announcement of the timing information can be used 
by Eve to access part of the sifted keys [10| • Recently, the imperfections of some particular 
single photon detectors, namely those based on passively or actively quenched avalanche 
photodiodes, and potential security loopholes of practical QKD systems employing such 
detectors have been studied in [lll|. For more general discussions, see |12l |. 

A key assumption in QKD is Alice encodes her signals correctly. This seems like a simple 
assumption. However, it may be violated in practice by, for example the phase-remapping 
attack [l3|. In this paper, we experimentally investigate the phase- remapping attack in 
a commercial QKD system. In contrast with the time-shift attack, the phase-remapping 
attack is an "intercept-and-resend" attack which allows Eve to gain the full information of 
the sifted keys. Here, we experimentally find that the phase remapping processjn a practical 
QKD system is much more complicated than the theoretical model in Ref. [13]. To adapt 
to this complexity, we have modified the original phase-remapping attack into type 1 and 



type 2 practical attacks, where type 2 attack is more practical in QKD systems. It is well 
known that in the standard BB84 QKD system, a simple "intercept-and-resend" attack 
will introduce a quantum bit error rate (QBER) of 25% which alarms the users that no 
secure keys can be generated. Our experimental results show that by performing the phase- 
remapping attack. Eve can gain the full information at the cost of introducing a QBER of 
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19.7%, which is lower than the proven security bound of 20.0% for the BB84 protocol 
In other words, the security of the commercial QKD system is compromised. 

This paper is organized as follows: in Section [TTl we summarize the basic idea of phase- 
remapping attack and then propose our theoretical model to analyze QBER. In Section IIIIl 
we describe the phase modulation scheme adopted in a commercial "plug and play" QKD 
system and discuss two types of practical attacks which could be applied to this specific 
design. In Section llVt we show the experimental results and analyze the QBER. We finally 
conclude our paper with some general comments in Section |Vl 

II. PHASE-REMAPPING ATTACK 

Practical limitations associated with phase and polarization instabilities over long dis- 
tance fibers have led to the development of bidirectional QKD schemes, such as the "plug- 
and-play" QKD structure |l5j] and the Sagnac QKD structure |16|. Specially, the "plug- 
and-play" structure is widely used in commercial QKD systems 17|. In this system. Bob 
first sends two strong laser pulses (signal pulse and reference pulse) to Alice. Alice uses 
the reference pulse as a synchronization signal to activate her phase modulator. Then Alice 
modulates the phase of the signal pulse only, attenuates the two pulses to single photon level, 
and sends them back to Bob. Bob randomly chooses his measurement basis by modulating 
the phase of the returning reference pulse. Since Alice allows signals to go in and go out 
of her device, this opens a potential back door for Eve to launch various attacks [Gj. One 
specific attack is the phase- remapping attack |13| . 

LiNbOs waveguide phase modulator is commonly used to encode random bits in fiber 
based phase-coding BB84 QKD system. In practice, a phase modulator has finite response 
time, as shown in Fig. [H Ideally, Bob's signal pulse passes through Alice's phase modulator 
in the middle of the modulation signal and undergoes a proper modulation (time to in Fig- 
[1]) . However, if Eve changes the time difference between the reference and the signal pulse. 
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FIG. 1: Diagram of phase modulation (PM) signal, to is the original time location where Bob's 
signal pulse is properly modulated to have phase (pQ. Eve time shifts the signal pulse from to to ti. 
This pulse will undergo a new modulated phase (pi. 

the signal pulse will pass through the phase modulator at a different time (time ti in Fig. [1]), 
and the encoded phase will be different. Originally, Alice uses {0, 7r/2, vr, 37r/2} to encode 
{Oi(bit "0" inbasel), 02(bit "0" in base2), li(bit "1" in basel), l2(bit "1" in base2)}. Now, 
after Eve's remapping process, Alice's encoded phases {0, it/2, n, 37r/2} will be mapped 
to {0, 01, 01 + 02, 01 + ^+ 03}, where 0i (i=l,2,3) is the new phase difference between 
two adjacent states. Ref fl3[ assumed for simplicity, that the phase modulator has the same 
rising time and proportional phase modulation for each encoded phase, i.e. 0i=02=03- Here, 
we consider a more general setting. The exact value of 0j depends on time displacement 
introduced by Eve and the actual phase modulation system. This phase remapping process 
allows Eve to launch a novel "intercept-and-resend" attack: phase-remapping attack. In our 
experiment, the practical attack strategy is: 

(1) Eve intercepts Bob's strong pulse and sends a time-shifted pulse to Alice via her own 
device. Note that Eve can change the actual values of 0j(i=l,2,3) by changing the time 
displacement. However, she cannot change 0i, 02, and 03 independently. 

(2) Eve's strategy is to either distinguish {Oi} from {O2, li, I2} or {I2} from {Oi, O2, li} 
with minimal errors. To distinguish {Oi}, Eve introduces a phase shift of {0i + 02} by using 
her phase modulator on the reference pulse sent back by Alice and performs an interference 
measurement. If detectorl has a click 18[, Eve sends a standard BB84 state {Oi} to Bob. 
Otherwise, Eve simply discards it. A similar procedure is performed to distinguish {I2}, 
where Eve introduces a phase shift of {0i} on the reference pulse. Here, we define Eve's 
phase shift {0i} as Basel, {0i + 02} as Base2. 

Now, assume that Eve uses Base2 to distinguish {Oi}; given Alice sends different states 



{Oi, O2, li, I2}, Detl's detecting probabilities {-Pod -P02! -Pin -^12) ^^^ {sin^ 
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0, sin (^)}. After Eve's attack, the error probabilities introduced are {0, 1/2, 1, 1/2}. The 



analysis in Basel can be carried out similarly. So the QBERs are 
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then the total QBER is given by 
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As shown in Fig. [21 there is a range of "0" that allows QBER to go below 20.0%, which 
is tolerable in the BB84 protocol lj|. So, if Eve remaps the phase small enough into this 
range, she can successfully apply this "intercept-and-resend" attack. 




FIG. 2: (Color online). QBER of phase-remapping attack. Eve remaps the four BB84 states with 
the same new phase difference {(pi = (p2 = (l^s = 'P) ■ 



III. EXPERIMENTAL PHASE-REMAPPING ATTACK IN A COMMERCIAL 
"PLUG & PLAY " QKD SYSTEM 

We implemented the phase remapping attack in a commercial ID-500 QKD system (manu- 
factured by id Quantique), as shown in Fig. [31 Bob's signal pulse, reference pulse and Alice's 




FIG. 3: (Color online). Experimental implementation of the phase-remapping attack in a com- 
mercial ID-500 QKD system. Original QKD system: LD, laser diode. Detl/Det2, single photon 
detector; PMA/B, phase modulator; C, circulator. PBS, polarization beam splitter; CD, classical 
photodetector; DL, delay line; FM, Faraday mirror. Our modifications: Eve replaces Bob; VODL, 
variable optical delay line; PC, polarization controller. 
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FIG. 4: (Color online). Time patterns of the reference pulse (Ref), the signal pulse (Sig) and the 
phase modulation signal in the commercial ID-500 QKD setup. Here, Alice's encoding phase is 
{vr} and we only show the forward pulses. 

phase modulation signal of the original QKD system are shown in Fig. HI Note that in Fig. 
m since Alice uses the reference pulse as a trigger signal, the time delay Ati is determined 
by the internal delay of Alice's system and can't be controlled by Eve. On the other hand, 
since Alice doesn't monitor the arrival time of the signal pulse. Eve can change the time 
delay At^ without being detected. Furthermore, the rising edge of the phase modulation 



signal is around 8ns, while the width of the laser pulse is about 500ps. Eve can easily place 
her pulse on the rising edge to get partial phase modulation. This specific QKD design 
opens a security loophole which allows Eve to launch the phase-remapping attack. 

In our experiment, Eve utilized the same setup as Bob to launch her attack. Eve modified 
the length of the short arm of her Mach-Zehnder interferometer by adding a variable optical 
delay line (VODL in Fig. [3]) to shift the time delay between the reference pulse and the 
signal pulse. To remap the phase small enough into the low QBER range, the optimal 
strategy we found is: by using VODL, Eve shifts the forward signal pulse out and only the 
backward signal pulse in the phase modulation range (see Fig. El^b)). 
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FIG. 5: Time pattern of practical phase-remapping attack. Sig: signal pulse. Ref: reference pulse. 
PM: phase modulation signal, (a) Normal QKD operation, (b) Type 1 practical phase-remapping 
attack, (c) Type 2 practical phase-remapping attack; here, even if we assume Alice has a perfect 
phase modulator with strictly sharp rising and following edge. Type 2 attack still works. 



One important practical challenge in our experiment is polarization control. The phase 
modulator in Alice's system is polarization dependent and has one principle axis. Photons 
with polarization aligned with the principle axis will undergo a large phase modulation, while 
photons with orthogonal polarization state will undergo a small phase modulation 19|. In 
our experiment, we find the relative modulation magnitude ratio of the two polarizations is 
about 1 : 3 [20]. In the original "plug and play" system, the signal pulse will be modulated 
twice as it passes through Alice's phase modulator back and forth (see Fig. |5]^a)). Because of 
the Faraday mirror, the total phase shift is independent of the polarization state of the signal 
pulse. However, since Eve's signal pulse will pass through the modulator at a different time 



and be modulated only once (see Fig. EJ^b)), the above auto-compensating method will not 
work. Eve has to control the polarization direction either aligned with or orthogonal to the 
principal axis of the phase modulator when her signal pulse is modulated. This is achieved 
by adding a polarization controller (PC in Fig. [3]) in Eve's system and adjusting it carefully. 
Here, Eve can assume that the polarization has been aligned properly by maximizing the 



total counts of D1+D2 (Dl and D2 denote the counts of Detl and Det2) |21 |. 

By combining variable shifting time and two different polarization directions, Eve can 
apply two types of practical phase-remapping attack: 

1. Type 1 practical attack is shown in Fig. |5t^b). Eve shifts the forward signal pulse 
out of the phase modulation signal and the backward pulse to the rising edge, and 
adjusts the PC to control the backward pulse's polarization direction aligned with 
the modulator's principal axis. Here, we remark that if the width of laser pulse is 
comparable with the rising time of the modulation signal, the type 1 attack will cause 
an unreasonably high QBER, thus it is easy for Alice and Bob to detect the attack. 

2. Type 2 practical attack is shown in Fig. |5]^c). Eve shifts the backward pulse to the 
plateau region of the phase modulation signal, and aligns its polarization direction 
orthogonal to the principal axis. Since the orthogonal direction has the smallest phase 
modulation. Eve can successfully remap the phase small enough into the low QBER 
range. One important advantage of type 2 attack is: even if Alice's phase modulator 
is good enough with strictly sharp rising and following edge (force type 1 attack 
noneffective). Eve can still apply type 2 attack in practical QKD systems. 



Another challenge is the optimization of VODL. Ref [13[ assumed Eve could remap Alice's 
encoded phase with 0i = 02 = 03- However, in our experiment, the relation among 0i, 02, 
and 03 is more complicated. As shown in Fig. El Alice's phase modulation signals {7r/2, it, 
37r/2} not only start at different times but also have different average rising times {6.12ns, 
7.82ns, 9.47ns}. Furthermore, there is also an overshoot after the rising edge, and the time is 
different from each other. So, if we use different lengths of VODL to shift the pulse either to 
the rising edge or to the overshooting range, the pulse will not undergo proportional phase 
modulation. Eve's remapping phase will be 0i 7^ 02 7^ 03- These complicated phases will 
thus cause an effect of QBER as shown in Eqn. (1). 
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FIG. 6: (Color online). (a)Alice's phase modulation signals, vr/2, vr, and 37r/2, respectively, (b) 
The zoomed rising edge of each modulation signal and the approximate time of the optimal VODL 
used in our attack. 

In our experiment, the optimal length of VODL was determined by minimizing the re- 
sulting QBER. We finally applied two optimal VODL (see Fig. |6]^b)) to launch two types of 
practical phase remapping attack: VODL A: 4.65m and VODL B: 5.8m. Our attack strategy 
was the one discussed in Section II. Here, we remark two points: (1) from the time pattern 
graph in Fig. HI the laser pulse is narrow enough to allow us to apply type 1 attack; (2) in 
type 1 attack, to make the remapping phase small enough, we still control the polarization 
of backward pulse orthogonal to the principal axis. 

IV. EXPERIMENT RESULTS 
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2.11 X 10 
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0.38 X 10-2 



5.82 X 10 
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1.39 



TABLE I: Experimental parameters. 



Some experimental parameters of our ID-500 commercial QKD system, including dark 
count rate Yo, detector error rate e^et, Bob's overall quantum efficiency rjBob (including 
the detection efficiency of single photon detector), detection efficiency rj and mean photon 
number /x are listed in Table HI Our transmission distance was a few meters. We repeated 



the measurement 10 million times for each state sent by Alice and the experimental results 
are shown in Table HTl 
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Base2 



State 



Dl 



D2 



Dl 



D2 



Dl 



D2 



Oi 0° 0° 

O2 90° 21.1° 

li 180° 37.8° 

I2 270° 52.7° 



617 168910 

5843 167206 

18096 153962 

33260 135616 



7068 174061 

1074 179218 

5285 174161 

19770 160300 



24841 156007 

8557 170786 

1239 176091 

3530 173428 



(a) 



BaseO 



Basel 



Base2 



State 



Dl 



D2 



Dl 



D2 



Dl 



D2 



Oi 0° 0° 

O2 90° 23.9° 

li 180° 35.9° 

I2 270° 46.3° 



734 171851 

7435 165402 

16474 157385 

26879 146917 



6617 166671 

928 169814 

3545 166427 

8434 161575 



16311 158479 

2772 169669 

1348 168924 

2672 168078 



(b) 

TABLE II: Experiment results. (Jja is Alice's original standard BB84 phase. (pE is the new phase 
remapped by Eve. Dl (D2) is the counts number of Detl (Det2). Here, Eve introduced phase {0} 
(BaseO), {4>i\ (Basel), and {(j)i + </>2} (Base2), respectively on the reference pulse to measure each 
state, and repeated the measurement 10 million times for each state, (a) Variable Optical Delay 
Line A (4.65m). (b) Variable Optical Delay Line B (5.8m). 



QBER is analyzed as follows. First, we calculate QBER from the theoretical model 
discussed in Section |Tll The detecting probability of phase-coding BB84 QKD protocol is 

1-COs(0a-0b) ^ 2/0A-0B^ Dl - NY^ 

(3) 

;ii A — din If/. — / V r /-I 

cos (- 



Detl : Pi 



Det2 : P2 



1 + cosichA - 



'B 



DI + D2- 2NYo 

D2 - NYo 
DI + D2- 2NYc 







where A^ denotes the gating number 22(]. Here, we subtract the dark counts number A"yo 
from each detector's counts number to get the theoretical detecting probability. 

If Eve introduces phase shift {0} (BaseO) on the reference pulse to measure each state, 



10 



the remapping phase (J)e and phase difference (pi (i=l,2,3) are 

_, / Dl-NYo ^ 
^ 1d2-NYo' (4) 

(pi = (pE{i) — (pE{i-l) 

Using data in Table HTl from Eqn. (4) and (1), we can get 

VODL A: (1)1 = 21.1° ±11° 02 = 16.7° ± 1.1° 03 = 14.9° ± 1.1° 

QBERuA) = 21% QBER21A) = 13% 

(5) 

VODL 5 : 01 = 23.9° ± 1.2° 02 = 12° ± 1.2° 03 = 10.4° ± 1.2° 



QBERk^b) = 29% QBER2(B) = S[ 



■0 



The phase error fluctuations are mainly due to the imperfections of our experimental 
QKD system. From the results in Table [TTl we can see that even though Eve uses BaseO to 
measure state {Oi}, it still has about "600 ~ 700" counts on Detl. These error counts are 
mostly from the imperfect interference between the signal pulse and the reference pulse. So, 
Eqn. (5) gives the theoretical QBERs introduced by Eve with perfect detection system. 

Now, we calculate QBER via our direct experimental results. From Table [TTl we can see 
the total counts (D1+D2) are almost identical, so Detl's detecting probability for each state 
is proportional to Dl. The QBERs can be calculated using data in Table [TTl 



^ + ^ + Dlo, 

Basel : QBERi = ^ ^ 

^ Dlo,+Z^lo.+/^li, +/^li, 

Base2 : QBER2 



^ + % + Dli, 



(6) 



Dlo, + Dlo, + DU, + Dh, 



(7) 



VOL A : QBERnA) = 21.8% QBER^i^A) = 19.1% 
VOL B : QBERn^B) = 30.8% QBER2^b) = 17.6% 
It is surprising to see that if Eve utilizes the optimal strategy to combine two types 
of attack together and carefully chooses the the probability of each attack to ensure the 
distribution of bit "0" and bit "1" received by Bob is balanced, the overall QBER will be 

QBER = ^^^-^i(A) + QBER2,B) ^ ^^^^^ ^g^ 

Note that we used weak coherent pulse (WCP) source in our experiment. Before calcu- 
lating the QBERs for single-photon (SP) source, we emphasize two facts: (1) the phase shift 

11 



introduced by the phase modulator is independent of the source. If the source is a SP, the 
phase will be also remapped to {0, 0i, 0i + 02, 01 + 02 + 03}- (2) Eve's interference visibility 
is the same for SP and WCP. Now, assume that Eve introduces Basel to launch attack and 
Detl's detecting probability for each state is Pstatei i-e- {-Pou P021 Piii ^12)1 Detl's overall 
gain and QBERs for the two different sources are given by: 

^P '■ Qsp = VBobPstate + Yq 

VBobi^ + ^ + P02) + 2Yo (9) 



QBER 



■sp 



VBobiPo^ + P02 + Pu + A2) + 41"o 



WCP : g^ep = 5^(yo + 1 - (1 - VBobPstatey)^e-'' = (1 - 6-^"^-^--'=) + Y, 
i=Q ^■ 

QBERy 



(10) 



""^P ~ 4 — Q-I^VBobPOi _ Q-l-l-VBobP02 — Q-l^l-VBobPli _ Q-IJ-VBobPl2 _|_ 4y„ 

Using Eqn. (9-10) and data in Table ID and IIT| the overall QBER difference between SP 
and WCP for Eve's optimal strategy (combine two types of attack as Eqn. (8)) is: 

AQBER = QBERsp - QBER^^p = 0.1% (H) 

Therefore, in a practical SP BB84 QKD system, we can expect the QBER is 



QBERsp=19.8%, which is lower than the tolerate security bound of 20.0% [14]. The secu- 
rity of SP BB84 QKD system is compromised. Eve can also combine the phase-remapping 



attack with a faked state attack together to substantially enhance its power 13|]. Finally, 
we remark that even if we have only broken a practical SP BB84 QKD system, the security 
proofs of both WCP and SP QKD are based on the same assumptions. One key assumption 
(Alice prepares her states correctly) has been violated in our experimental demonstration. 
So the security proofs can not be directly applied to a practical QKD system. 

V. CONCLUSION 

We conclude this paper with some general comments. First, let us consider countermea- 
sures. In the "plug-and-play" QKD system, one specific countermeasure is the following: 
Alice carefully checks the arrival time of the reference pulse and the signal pulse by mon- 
itoring with her classical detector (CD in Fig. |3]). From the time delay between the two 
pulses, she can find whether the time difference has been shifted by Eve, and thus counter 

12 



Eve's attack. Moreover, in our attack, Eve only sends two states to Bob. Alice and Bob 
can detect this attack by estimating the statistics of the four BB84 states. Note that, once 
a security loophole has been found, it is often easy to develop count ermeasures. However, 
the unanticipated attacks are the most fatal ones. 

Second, this paper mainly focuses on one key assumption in unconditional security proofs, 
i.e. Alice prepares the required states correctly. From a simple experimental demonstration, 
we show this assumption can be violated by our attack. So, we emphasize that, in a practical 
QKD system, Alice needs to experimentally verify she is applying the correct modulations 
on her states. One possible way in a general QKD system is: after encoding her random 
bits, Alice uses a beam splitter to split part of each strong modulated signal, and then 
use a classical detector, such as a power meter (rather than a single-photon detector), to 
implement a local measurement to directly verify whether she has performed the correct 
modulation. In order to achieve unconditional security with a practical QKD system, it is 
useful to perform such a verification experimentally. In the long term, it is important to 
work towards QKD with testable assumptions. 

Third, Eve can also maximize her ability to eavesdrop by combining various attacks. 
For instance, she may combine the phase-remapping attack with the time-shift attack to 
exploit both the imperfections of Alice's encoding system and Bob's detection system. If 
she does so, the QBER might be reduced further. We remark that, it is impossible to 
remove all imperfections completely in practice. Instead of removing them, what we can do 
is to quantify them carefully. Once quantified, those imperfections may be taken care of in 
security proofs p, l23|. As an example, mismatch in detection efficiency has been taken into 



account in the security proof of |24|. 



Finally, our demonstration of the phase remapping attack was done on a specific im- 
plementation of QKD. Notice, however that the implementation is the one widely used in 
commercial QKD systems [17| • Moreover, in a general class of QKD systems and protocols, 
our work highlights the significance for Alice to verify the correctness of her preparation. 
In practice, any QKD is done on a specific implementation and it has imperfections. If we 
can't trust a specific implementation of QKD, one should never use QKD in the first place. 

In summary, we have experimentally demonstrated a technologically feasible attack, 
where Eve can get full information and only introduces a QBER of 19.7%. A simple 
"intercept-and-resend" attack will normally cause a QBER of 25% in BB84. So, our re- 

13 



suit shows clearly an imperfection in the QKD implementation. The security of a single 
photon BB84 QKD system has been compromised. Specially, this is the first successful 
"intercept-and-resend" attack on top of a commercial bidirectional QKD system. The suc- 
cess of our attack highlights not only the importance for Alice to verify that she is encoding 
the right state during the encoding process, but also, more generally, the importance of 
verification of the correctness of each step of an implementation of a QKD protocol in a 
practical QKD system. 
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